worker_processes 1;

events { worker_connections 1024; }

# required for non root
pid        /tmp/nginx.pid;

http {

    # required for non root
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path       /tmp/proxy_temp_path;
    fastcgi_temp_path     /tmp/fastcgi_temp;
    uwsgi_temp_path       /tmp/uwsgi_temp;
    scgi_temp_path        /tmp/scgi_temp; 

    client_max_body_size 1m;
        
    server {
        listen 8080 default_server;

        # prevent redirecting to 8080 port
        # (e.g. when trailing slash is missed)
        port_in_redirect off;

        # letsencrypt
        location /.well-known/acme-challenge/ {
            root /service/html/certbot;
        }

        location /check {
            # set alias (instead of root) to not append /check to path
            alias /service/html/check;
        }

        location / {
            return 302 https://$host$request_uri;
        }
    }

    server {
        listen 8443 ssl;

        # prevent redirecting to 8080 port
        # (e.g. when trailing slash is missed)
        port_in_redirect off;

        server_name example.com www.example.com localhost;
        
        ssl_certificate        /service/ssl/example.com/fullchain.pem;
        ssl_certificate_key    /service/ssl/example.com/privkey.pem;
        
        location / {
            # allow for upstream to be offline by setting
            # docker dns resolver and a variable for the server
            resolver           127.0.0.11 valid=30s;
            set                $kweb kweb;
            proxy_pass         http://$kweb:8080;

            proxy_redirect     off;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Host $server_name;
        }
    }

}